Most people know their passwords are bad. They reuse them. Make them too short. Use birthdays, pet names, or the same password with tiny changes across dozens of websites. And hackers know it too.